Thursday, August 6, 2026 · generated · about 6 min read
Morning Brief
Patch today vendors with the most new CVEs today
- Unknown 35
- WordPress 32
- IBM 32
- Cisco 5 critical 23
- Jenkins 1 critical 23
- Microsoft 1 critical 20
- Red Hat 2 critical 17
- Linux 16
- WSO2 2 critical 11
- electron 10
Ranked by CVE count. Each vendor opens the CVE Feed filtered to that vendor and these dates.
Top developments ranked by cross-source trending
-
Image: Dark Reading Flaws in Google APK for Python Unlock Agent-to-Agent Attack
Google has fixed the issues, which exploited a trust boundary between two AI agents with different privilege levels to trigger automation that could compromise the supply chain.
Also in Cyber Security News Bleeping Computer SecurityWeek +3
-
Anthropic’s AI used fake identities, malware in rogue attack on GitHub project
Routine cybersecurity testing of frontier AI models sparked a series of unexpected security incidents—the most serious case arising when Anthropic’s Mythos 5 model attempted to insert malicious code into an open source software application and created fake identities to deceive the human developers maintaining the project. The security incidents occurred during a cyber evaluation of seven leading AI models’ capabilities by the AI Security Institute (AISI), a research organization within the UK government, in late July. The researchers discovered 19 instances in which “AI agents took…
Also in SANS Internet Storm Center The Hacker News CyberScoop +2
-
Hackers Turned Microsoft Logins, Zoom Events, and Government Websites Into Attack Tools
Cybercriminals spent July 2026 proving that trusted business utilities including Microsoft authentication pages, Zoom event invitations, and official government portals can be weaponized against enterprise targets. Threat intelligence research from ANY.RUN reveals that attackers across the United States, Europe, and Brazil systematically exploited routine corporate workflows to bypass perimeter security controls, harvest credentials, and maintain long-term access to systems. Hackers Turn Trusted Sites Into Attack Tools The defining trend across July’s threat landscape was the exploitation of…
Also in The Hacker News Bleeping Computer 404 Media +3
-
CISA Flags TeamCity CVE-2026-63077 RCE Flaw Under Active Exploitation in the Wild
A newly patched security flaw impacting on-premise versions of JetBrains TeamCity has come under active exploitation in the wild, according to the U.S. Cybersecurity and Infrastructure Security Agency (CISA). The vulnerability in question is CVE-2026-63077 (CVSS score: 9.8), a case of deserialization of untrusted data that could allow an unauthenticated attacker with access to a TeamCity server
Also in Cyber Security News SecurityWeek CISA Alerts & Advisories
-
Apple iCloud Private Relay WebKit Flaws Leak Users’ Real IP Addresses
Apple users who rely on iCloud Private Relay to conceal their online location may not be getting the protection they expect. Newly disclosed flaws in WebKit, the browser engine used across iOS, can allow a website to see a visitor’s real IP address. The exposure weakens a privacy safeguard. The issue can be triggered when a site supports, or merely claims to support, passkeys. A device may make a separate network request during sign-in, outside the protected browser route. That creates an opening for a malicious site to collect the address. Researchers Tommy Mysk and Talal Haj Bakry…
Also in 404 Media Malwarebytes Labs The Hacker News
-
IBM's agentic AI platform is under active attack - patch now
A critical vulnerability in IBM-owned, low-code AI builder Langflow lets unauthenticated attackers execute code remotely on vulnerable default deployments, potentially putting organizations running those instances at immediate risk. The Cybersecurity and Infrastructure Security Agency (CISA) on Tuesday added CVE-2026-9198 to its Known Exploited Vulnerabilities catalog after identifying evidence of active exploitation and urged organizations to apply the vendor's mitigation guidance as soon as possible. IBM says the flaw affects Langflow OSS versions 1.0.0 through 1.10.0 and recommends…
Also in Bleeping Computer CCCS Alerts & Advisories CISA Alerts & Advisories
-
250+ macOS ClickFix Domains Use Browser Fingerprinting to Hide Atomic Stealer Attacks
Atomic Stealer is being pushed at Mac users through websites that look harmless. A large ClickFix operation uses more than 250 look-alike domains to steer selected visitors toward a fake download page and a malicious Terminal command. ClickFix is built on persuasion, not a software flaw. The pages pose as download checks, updates, or CAPTCHA-style verifications, then urge people to paste a command into Terminal to begin the attack. Microsoft analysts identified this shift. They found that the infrastructure moved from openly displaying malicious instructions to testing each visitor before…
Also in The Hacker News Microsoft Security Blog
-
Ransom Cartel Creator Gets 16 Years in Prison for Operating Ransomware-as-a-Service
A federal judge in Alexandria, Virginia, sentenced Maksim Silnikau to 16 years in prison on August 5 for creating and running Ransom Cartel, the ransomware-as-a-service operation he stood up in 2021. Between 2021 and 2023, Ransom Cartel conspirators attacked at least 18 companies, including firms in California, New York and Nebraska, and others abroad, according to the Justice Department.
Also in SecurityWeek Bleeping Computer
-
Cisco Patches Multiple Critical Cisco IOS XE Software Vulnerabilities – Patch Now!
Cisco has released a critical security hardening update for Cisco IOS XE Software, fixing several serious vulnerabilities that could expose enterprise network devices to remote attacks. The advisory covers vulnerabilities identified during Cisco’s internal security testing, including testing supported by frontier AI models. Cisco said it is not aware of public exploitation or malicious activity linked to these flaws. However, the severity of the issues, combined with the lack of available workarounds, makes prompt patching essential. The vulnerabilities affect Cisco IOS XE Software running in…
Also in SecurityWeek Cyber Security News The Register Security
-
AWS, Google, and Vercel Agent Flaws Let Attackers Trigger Tools Without Running the Model
Security flaws in agent infrastructure from Amazon Web Services (AWS), Google, and Vercel let untrusted or forged instructions reach an agent's tools with no check that a model turn had authorized them. In several of the attack paths, the model never ran at all, so system prompts, content filters, and model-level guardrails never got a chance to intervene. The affected products include Amazon
Also in Wired Security
Vulnerability watch what to look at, most urgent first
| Details | CVE | Product | Severity | CVSS | EPSS | KEV | Fix | In the news | |
|---|---|---|---|---|---|---|---|---|---|
| Highest scoring today 10new CVEs, highest CVSS first | |||||||||
| CVE-2026-48168 | PraisonAIMicrosoft | Critical | 10.0 | — | — | — | — | CVSS 10.0 | |
What it isPraisonAI is a multi-agent teams system. In versions prior to 4.6.40, the bundled Claude GitHub Actions workflow is vulnerable to command injection because it embeds an attacker-controlled pull request branch name into a Bash run: block wit… Attack
Exploitation
|
|||||||||
| CVE-2026-5430 | WSO2 Universal GatewayHashiCorp | Critical | 10.0 | — | — | — | — | CVSS 10.0 | |
What it isThe JWT authentication mechanism accepts tokens signed with algorithms other than those explicitly configured or supported. This allows an attacker to craft a JWT with an unsupported algorithm, which is then incorrectly validated, leading t… Attack
Exploitation
|
|||||||||
| CVE-2026-10090 | Red Hat Advanced Cluster Management for Kubernetes 2Red Hat | Critical | 9.9 | 0.2% | — | — | — | EPSS 0.2%CVSS 9.9 | |
What it isA flaw was found in the Application Subscription controller (multicluster-operators-subscription) of Red Hat Advanced Cluster Management for Kubernetes (ACM). A user with namespace-scoped "edit" privileges in an ACM hub namespace can create… Attack
Exploitation
|
|||||||||
| CVE-2026-71268 | OpenPLC_v3thiagoralves | Critical | 9.9 | — | — | — | — | CVSS 9.9 | |
What it isOpenPLC Runtime v3's compile_program() function (webserver/openplc.py) parses `(*FILE:path content*)` directives from uploaded Structured Text (.st) program files and writes the referenced content to `os.path.join('./core', file_path)` with… Attack
Exploitation
|
|||||||||
| CVE-2026-7329 | MarkLogic ServerProgress | Critical | 9.9 | — | — | — | — | CVSS 9.9 | |
What it isAn improper privilege management vulnerability in the SQL, SPARQL, and Optic REST query interfaces of Progress MarkLogic Server before 11.3.6 and 12.0.3 allows an authenticated user with a low-privileged REST role to escalate privileges to … Attack
Exploitation
|
|||||||||
| CVE-2026-8709 | MarkLogic ServerProgress | Critical | 9.9 | — | — | — | — | CVSS 9.9 | |
What it isAn improper privilege management vulnerability in the REST API document patch operation of Progress MarkLogic Server before 11.3.6 and 12.0.3 allows an authenticated user with a low-privileged REST role to escalate privileges and execute pr… Attack
Exploitation
|
|||||||||
| CVE-2026-9193 | MarkLogic ServerProgress | Critical | 9.9 | — | — | — | — | CVSS 9.9 | |
What it isAn improper privilege management vulnerability in the Hadoop integration of Progress MarkLogic Server before 11.3.6 and 12.0.3 allows an authenticated user with a low-privileged Hadoop role to escalate privileges and execute privileged oper… Attack
Exploitation
|
|||||||||
| CVE-2026-20303 | Cisco Catalyst SD-WAN ControllerCisco | Critical | 9.9 | — | — | — | — | CVSS 9.9 | |
What it isAs part of Cisco's ongoing commitment to proactive security and product quality, the Cisco Catalyst SD-WAN engineering team has conducted a comprehensive internal security review. This review resulted in software hardening releases that add… Attack
Exploitation
|
|||||||||
| CVE-2026-20304 | Cisco Catalyst SD-WAN ControllerCisco | Critical | 9.9 | — | — | — | — | CVSS 9.9 | |
What it isAs part of Cisco's ongoing commitment to proactive security and product quality, the Cisco Catalyst SD-WAN engineering team has conducted a comprehensive internal security review. This review resulted in a software hardening release that ad… Attack
Exploitation
|
|||||||||
| CVE-2026-70615 | boringproxyboringproxy | Critical | 9.9 | — | — | — | — | CVSS 9.9 | |
What it isboringproxy through 0.10.0 contains a newline injection vulnerability that allows authenticated low-privileged users with tunnel-creation permission to inject arbitrary lines into the server account's SSH authorized_keys file by supplying a… Attack
Exploitation
|
|||||||||
Click a row, or press +, to expand it.EPSS is FIRST's estimated chance of exploitation in the next 30 days.Full CVE Feed
Worth reading quieter, still worth your time
-
CVE-2026-18577: N-able N-central Authentication Bypass Exploited in the Wild
Overview On August 2, 2026, N-able published a security advisory for CVE-2026-18577 , an authentication bypass vulnerability affecting N-central that was discovered being exploited in-the-wild after an incomplete fix for an earlier authentication bypass issue, CVE-2026-18556 was disclosed. CVE-2026-18577 allows a remote unauthenticated attacker to bypass authentication and obtain administrative control of vulnerable N-central servers in affected deployments. N-able N-central is a widely deployed Remote Monitoring and Management (RMM) platform used by managed service providers (MSPs) and…
Also in Sophos Threat Research Dark Reading CISA Alerts & Advisories
-
Shai-Hulud strikes again: CHAINDROP worm hits 400+ npm packages
On August 4, 2026, Elastic Security Labs identified a new Shai-Hulud campaign targeting the maintainer of keyv , a widely used key-value storage library. The attackers trojanized the monorepo and embedded a self-propagating worm called CHAINDROP that uses stolen npm credentials to automatically backdoor every other package the maintainer had publish rights to. The reach of this compromise is significant: keyv alone received over 600 million downloads last month, with related packages compounding the exposure: flat-cache near 580 million, cacheable-request at over 137 million, cacheable at…
Also in Infosecurity Magazine
Assembled automatically, once a day, from data the Security Feed and CVE Feed already collect and score. No AI writes any of this, and every number traces back to something already published on those two tools.
Top developments come from the Security Feed's cross-source trending detection. Vulnerability watch comes from the CVE Feed's daily NVD and CISA KEV sync.